# DNS Amplification Attacks: How Attackers Turn Resolvers Into Weapons

> Open DNS resolvers can amplify traffic 70x. Millions are still reachable on the public internet — making DNS one of the most exploited DDoS vectors today.

- Category: Attack Analysis
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/dns-amplification-attack

---

DNS amplification is a reflection attack: the attacker spoofs the victim's IP and sends small DNS queries to open resolvers. The resolver sends a large DNS response — sometimes 70x larger — directly to the victim. Multiply this across 100,000 open resolvers and you have a terabit-scale attack.

## The Amplification Math

> **Attack arithmetic** — A 40-byte DNS query for a large DNSSEC-signed zone can produce a 4,096-byte response — a 100x amplification factor. With 50,000 open resolvers sending simultaneously, a 1Gbps attacker generates 100Gbps of inbound traffic at the victim.

## Why Open Resolvers Still Exist

- Misconfigured home routers and ISP equipment.
- Legacy DNS servers left open for 'convenience'.
- Cloud instances launched without firewall rules.
- Estimated 5+ million open resolvers still reachable as of 2025.

## What the Target Sees

All traffic appears to come from legitimate DNS servers — IPs that are impossible to globally blacklist. Standard rate-limiting and IP blocklists fail. Only a scrubbing proxy that can distinguish legitimate DNS responses from reflection traffic can stop the attack effectively.

## Where Akarguard Helps — and Where It Doesn't

- DNS amplification is a network-layer (L3/L4) flood; the raw UDP/53 traffic has to be dropped upstream, at your host or transit provider's network — not by an HTTP reverse proxy.
- Ask your provider whether they perform BCP38 source-address validation and can filter reflected UDP at the edge of their network.
- Behind Akarguard your origin IP is hidden, so a flood aimed at your server has no direct target.
- Akarguard filters the application-layer (L7) attacks that reach your site; it is not a volumetric UDP scrubber and does not claim to be.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.